Audit Highlights

The following are highlights of our work during the October 1, 2024–March 31, 2025, semiannual reporting period.

The Board’s Information Security Program
The Board’s information security program continues to operate effectively at a level-4 (managed and measurable) maturity. However, the Board can strengthen its information security program in eight distinct areas.

The CFPB’s Information Security Program
The CFPB’s information security program continues to operate effectively at a level-4 (managed and measurable) maturity. However, the CFPB can strengthen its information security program in six distinct areas.

The Board’s Financial Statements Audit
The independent public accounting firm we contracted with found that the Board’s financial statements presented fairly, in all material respects, the financial position of the Board as of December 31, 2024 and 2023, and the results of its operations and its cash flows for those years in conformity with U.S. generally accepted accounting principles. The auditors also found that the Board maintained, in all material respects, effective internal control over financial reporting and found no instances of noncompliance with laws, regulations, contracts, or other matters.

The CFPB’s Transitioning of Depository Institutions
The CFPB did not timely or effectively complete most of the transitions of institutions to its oversight that we reviewed, in some cases taking over a year to complete key onboarding steps. The agency also took varying approaches to coordinating with the prudential regulators.

The Federal Financial Institutions Examination Council’s Financial Statements Audit
The independent public accounting firm we contracted with found that the Federal Financial Institutions Examination Council’s (FFIEC) financial statements presented fairly, in all material respects, the financial position of the FFIEC as of December 31, 2024 and 2023, and the results of operations and cash flows for those years in accordance with U.S. generally accepted accounting principles. The auditors did not identify any deficiencies in internal control over financial reporting; any instances of noncompliance with laws, regulations, contracts, and grant agreements; or any other matters.